fix(auth): trust forwarded headers only from trusted proxies

[rain02333z-spec]

Why

csrf_middleware.py trusted Forwarded / X-Forwarded-* on direct requests, so a client could spoof the browser-facing scheme/origin used by auth same-origin checks and OIDC fallback redirect_uri construction.

What changed

• Forwarded / X-Forwarded-* are only honored when the TCP peer matches AUTH_TRUSTED_PROXIES.
• Direct requests now resolve scheme/origin from the real request scheme and Host.
• OIDC fallback redirect_uri continues to use the shared origin resolver.
• README and backend agent docs now describe the trusted-proxy boundary.

Surface area

• Frontend UI - page / component / setting / interaction under frontend/
• Backend API - endpoint / SSE event / request-response shape under backend/app
• Agents / LangGraph - agent node, graph wiring, langgraph.json, or prompt change
• Sandbox - docker/ or sandboxed execution
• Skills - change under skills/
• Dependencies - new/upgraded entry in backend/pyproject.toml or frontend/package.json (say what it buys us)
• Default behavior change - changes existing behavior without the user opting in (default model, default setting, data shape)
• Docs / tests / CI only - no runtime behavior change

Screenshots / Recording

N/A - backend security hardening only.

Bug fix verification

• Test path that reproduces the bug:
  • backend/tests/test_csrf_middleware.py::test_auth_post_rejects_spoofed_forwarded_same_origin_without_trusted_proxy
  • backend/tests/test_oidc_auth.py::test_oidc_redirect_uri_fallback_ignores_forwarded_headers_from_untrusted_peer
• Did it go red on main and green on this branch? Not run on main locally; the regression tests encode the previous unconditional forwarded-header trust path and are green on this branch.
• If a red test wasn't cheap to write, explain why and what you did instead: N/A.

Validation

• cd backend && uv run pytest tests/test_csrf_middleware.py tests/test_oidc_auth.py tests/test_auth_type_system.py -q with TEMP/TMP/TMPDIR pointed at backend/.tmp: 105 passed.
• cd backend && uv run ruff format --check app/gateway/csrf_middleware.py tests/test_csrf_middleware.py tests/test_oidc_auth.py tests/test_auth_type_system.py && uv run ruff check app/gateway/csrf_middleware.py tests/test_csrf_middleware.py tests/test_oidc_auth.py tests/test_auth_type_system.py: passed.
• Broader local Windows auth subset cd backend && uv run pytest tests -k "auth or csrf or oidc" -q hit unrelated environment/platform failures in Lark/WeChat auth tests (lark-cli exit/path separator and Windows chmod mode assertions): 674 passed, 5 skipped, 7 failed, 10475 deselected.

AI assistance

Tool(s) used: Codex

How you used it: Implemented the trusted-proxy guard, added regression tests/docs, ran focused backend validation, and opened this PR from the requested plan.

• Human owner still needs to read and take responsibility for every line before merge.